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TYPE <: function [dom, dom -> bool]] 
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correctness_proof : MODULE 

USING correctness, voted_step, nonvotecLstep, sensor_step, 
noetherian [C , Gbar] 
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Formal specification and verification revealed typos in the 
original report 
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We have the beginnings of a formally verified model for a 
fault tolerant operating system 


